Sign in

v128

latestOpenAPI 3.0.3Apache 2.0raw.githubusercontent.com2026-08-07818351991.2 KB
app

get app embed token by secret

get/w/{workspace}/apps_u/embed_token/{secret}

Path parameters

workspacestring required
secretstring required

Query parameters

sdk_consentboolean

Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.

Response

embed token

tokenstring nullable

Scoped token for the app. For sandboxed low-code apps this is the embed token handed to the opaque iframe. For a raw app it is the viewer-scoped frontend SDK token, returned only when the app is sandboxed, its policy declares frontend_sdk_scopes, and the request carries sdk_consent=true. Absent for anonymous viewers and whenever no token is needed.

expirationstring date-time nullable

Expiration of the embed token.

raw_appboolean required

Raw apps render single-iframe and skip the opaque-viewer indirection and the embed token entirely. A sandboxed one may still carry a token here: the viewer-scoped frontend SDK token, which is a different credential from the low-code embed token.

sandboxboolean required

Publisher opted this app into sandbox isolation. When false the viewer runs the app same-origin with its full session.

app_pathstring nullable

The resolved app path; the embedder uses it to scope the app's backing localStorage per app.

workspace_idstring nullable

The resolved workspace; pairs with app_path so apps at the same path in different workspaces don't share a localStorage store.

sdk_scopesstring[] nullable

Sandboxed raw apps: scopes the app policy declares for the frontend SDK token. Null when the app is unsandboxed, however the policy reads. The viewer renders these in the permission prompt; token stays absent until the endpoint is re-called with sdk_consent=true.

viewer_emailstring nullable

The caller's own email, returned alongside sdk_scopes so the viewer can key its stored "do not ask again" per person.